Hi,
I'm sorry I don't have a good answer for you and not sure how to solve it. What I can tell you is based on my recollection of the code the last time I looked into it, for AD it tries to authenticate the user just by using username@domainname with the provided password using the LDAP/AD server specified, it does not really use the DN setting except for when using OpenLDAP.
So as long as your AD machine could authenticate users from the sub domains it should work, but if the sub domain members need to be authenticated using a different @domainname then the current implementation is not going to work for you.
Best,
Joe